Logics and admissible rules of constructive set theories

We survey the logical structure of constructive set theories and point towards directions for future research. Moreover, we analyse the consequences of being extensible for the logical structure of a given constructive set theory. We finally provide examples of a number of set theories that are extensible. This article is part of the theme issue ‘Modern perspectives in Proof Theory’.


Introduction
Constructive set theories are formal systems in which we can conduct intuitionistic or constructive mathematics. Many systems of constructive set theory have strong connections to type theory and are interesting because they allow us to analyse the computational content of mathematical statements.
When a constructive mathematical theory T is defined, we usually pay special attention to ensure that not all instances of the law of excluded middle, p ∨ ¬p, are derivable in T. Even if an axiom looks constructive, it may happen that it entails this logical law, and if all instances of the law of excluded middle are derivable, then the axiom is constructively unacceptable.
Consider, for a well-known example, the famous theorem by Diaconescu [1] and Goodman & Myhill [2] that adding the axiom of choice to intuitionistic set theory IZF (Intuitionistic Zermelo-Fraenkel set theory) results in the classical ZFC set theory. This result is often taken as evidence for rejecting the axiom of choice as constructively valid. However, showing that a certain instance of excluded middle is not constructively valid is not sufficient for ensuring that only principles of intuitionistic logic are satisfied. After all, there could be intermediate principles that are derivable in T. Dick de Jongh was the first to investigate this phenomenon: in his doctoral dissertation [3], he showed that the propositional principles valid in Heyting arithmetic (HA) under all substitutions are exactly those of propositional intuitionistic logic (IPC). This fact is now known as de Jongh's theorem and has sparked fruitful investigations into the logical structure of intuitionistic arithmetic. A generalization of de Jongh's theorem would be to consider not only the propositional principles of HA but also its propositional admissible rules (see definition 2.3). Visser [4] showed that the propositional admissible rules of HA are exactly those of IPC. A further generalization would be to consider the two notions in the setting of predicate logic.
In this article, we survey results about the logical structure of constructive set theories and also provide a few new results in the area as well as questions for future research.
The study of the logical properties of classical and non-classical theories goes back at least several decades. Early results on the logics of theories date from the 1970s, and Rybakov's seminal work on admissibility [5] marked the beginning of a period during which the admissible rules were investigated for many theories, see [6] for an overview. What is characteristic of that period is that the theories involved were mainly arithmetical theories, such as HA, or extensions of propositional logics, such as modal, intermediate and substructural logics. This naturally leads to the more general questions studied today, questions that ask whether the phenomena observed for arithmetic apply to other well-known constructive theories, and whether the phenomena observed for propositional logics also hold for predicate logics. Behind all this lie conceptual issues as well: What does it mean for a theory to have the same logic or rules as a given theory? Should it be required of a genuine constructive theory that it has the same admissible rules as intuitionistic propositional or predicate logics? These questions characterize the modern perspective on the area. We do not know the answers to all of them yet, but the results in this article provide some answers for constructive set theories.

(a) Overview
We will introduce what we understand as the logical structure of a theory in §2 and then survey the techniques and results obtained so far in §3. Section 4 will be dedicated to obtaining a few new results. We mention suggestions for future research throughout the article and also list some more in §5. Finally, we discuss the logics and admissible rules of the extreme case of classical theories in §6.
However, one may of course still wonder whether the first-order admissible rules of any two theories are the same (question 5.1) or study the admissibility of specific interesting rules (see, e.g. van den Berg & Moerdijk [7]). Another reason to consider these questions separately is that, of course, the more complex objects require more complicated proofs than the simpler ones. In a sense, question (iv) can often be seen as a litmus test for the more difficult questions (ii) and (iii): if we conjecture that QL(T) = IQC, then showing that L(T) = IPC is a step in the right direction (though there are counter examples, e.g. L(IZF) = IPC but QL(IZF) = IQC, see §3). It may even be necessary to know an answer to (iv) before applying certain techniques for obtaining an answer to (ii), viz. the propositional admissible rules of T. We will see much more detail in the remainder of this article. For now, we will dive a bit deeper into the logics and propositional admissible rules of a given theory.
We say that a theory T is based on a logic J if T is axiomatized over J. As the results discussed in this article show, if a theory T is based on IQC, we do not necessarily have that QL(T) = IQC. Crucially, we cannot only study the logics of a theory T based on intuitionistic logic but, given an intermediate logic J, we can consider the theory T(J) obtained as the closure of T under J. de Jongh et al. [8] studied these theories and defined the de Jongh property as follows.
Definition 2.8. Let J be a propositional or first-order intermediate logic. A theory T has the de Jongh property for J just in case L(T(J)) = J if J is propositional or QL(T(J)) = J if J is first order.
We also say that a theory T satisfies de Jongh's theorem if L(T) = IPC, and that T satisfies de Jongh's theorem for first-order logic if QL(T) = IQC. To illustrate research in this area, we now give an incomplete history of de Jongh's theorem for arithmetical theories (see de Jonghet al. [8] for a more complete history). De Jongh [3] proved that L(HA) = IPC-; in other words, he proved that HA satisfies the de Jongh property for IPC. Leivant [9] showed using proof theoretic means that QL(HA) = IQC; van Oosten later gave a model theoretic proof of the same fact. De Jongh et al. [8] proved that HA has the de Jongh property for several classes of intermediate logics. The following propositions are immediate from proposition 2.5. A first crucial observation on the admissible rules of a theory is that these are bounded by its logic. Not much is known about the converse direction. A counterexample could be obtained with theorem 2.7 if it turns out that the predicate admissible rules of IQC are of complexity lower than Π 0 2 -completeness. We close these preliminaries with two particularly helpful results for studying the propositional admissible rules of a given theory. A theory T is called extensible if any Kripke model of T can be extended by adding a new root and corresponding domain to obtain a new model of T (see also definition 4.1). The Visser rule V n is the following rule for propositional formulas A i , B i and C:

Proposition 2.9. Let T ⊆ S be theories in the same language. If A is a tautology of T, then it is a tautology of S. In particular, L(T) ⊆ L(S) and QL(T) ⊆ QL(S).
The collection of Visser rules consists of the rules V n for every n. In other words, there is a proof tree, potentially using A as a premise, all steps in which are instances of the rules of IPC and V, and whose conclusion is B. Given that Visser's rules are admissible in T, and using the fact that T is based on intuitionistic logic, it is straightforward royalsocietypublishing.org/journal/rsta Phil. Trans. R. Soc. A 381:  to see that every rule application in the proof tree is admissible in T. Hence, B is an admissible consequence of A, A ∼ T B.
The two theorems give two routes to proving that the propositional admissible rules of a theory T are exactly those of IPC. We will see that theorem 2.12 can be seen as an instance of theorem 2.13 because Visser's rules are admissible in any extensible theory (lemma 4.7). In this section, we covered the preliminaries for theories based on intuitionistic logic. There is more to say for the extreme case of theories based on classical logic, see §6.

Survey on techniques and results (a) Constructive set theories
In this section, we can only give a very brief introduction to constructive set theory. As usual, the language L ∈ of set theory is a first-order language with equality and a single binary relation symbol '∈' to denote set membership. We consider the bounded quantifiers ∀x ∈ a ϕ(x) and ∃x ∈ a ϕ(x) to be abbreviations for ∀x(x ∈ a → ϕ(x)) and ∃x(x ∈ a ∧ ϕ(x)), respectively. The crucial aim of intuitionistic and constructive set theories is to provide a set-theoretic foundation for mathematics on the basis of intuitionistic instead of classical logic. We will now introduce the relevant systems.
In figure 1, we have spelt out all the axioms of set theory, giving rise to the following theories. Note that 'z is full in x and y' means that every element of z is a total relation between x and y and for every total relation w between x and y, and there is some u ∈ z such that u ⊆ w. We can now define the relevant theories. The bounded separation consists of all instances of (separation), where ϕ is a bounded formula (i.e. ϕ is 0 ). In a similar way, we obtain the axiom scheme of bounded collection.  The theory IZF R is IZF with replacement instead of collection, and CZF ER is CZF with exponentiation and replacement instead of strong collection and subset collection.
Note that CZF is usually formulated with the axiom of infinity instead of strong infinity. Obviously, the axiom of strong infinity implies infinity. The converse is also true on the basis of CZF without any infinity axioms [11, section 2.1]; so we can consider CZF to be formulated with the axiom of strong infinity instead of infinity, as this will be important later. For a detailed development of the mathematics of and in constructive set theories, we refer the reader to the notes of Aczel & Rathjen [12]. Whenever we discuss the results for an arbitrary set theory T in this article, we assume that T contains at least intuitionistic logic.

(b) Techniques and results
We will now survey what is known about the logical structure of constructive set theories. For many years, only the following two negative results were known.  While we do not wish to spell out the proofs of these theorems in detail, we will point out here that both of them make crucial use of the separation scheme to define sets that allow to derive a logical scheme for all formulas. This observation is crucial as we will see in a while that Passmann [14] showed that both theorems fail on the basis of CZF, i.e. when the set theory does not contain the full separation scheme. Note that theorem 3.3 leads to the following open question.

Question 3.4. Let T be a set theory, based on intuitionistic logic, satisfying the conditions of theorem 3.3. What is QL(T)? In particular, what is QL(IZF)?
Before considering more recent results, we will briefly recall some notation and results on Kripke models. A Kripke frame (K, ≤) consists of a partial order ≤ on a set K. A valuation V on (K, ≤) is a function V assigning sets of propositional letters to nodes such that v ≤ w and p ∈ V(v) entail p ∈ V(w). A Kripke model (K, ≤, V) consists of a Kripke frame (K, ≤) and a valuation V on (K, ≤). The valuation V can be extended to the forcing relation between Kripke models and valuation Kripke models and propositional formulas in the usual way. The defining property of valuations is called persistence and transfers to all propositional formulas in Kripke models, i.e. v ϕ and v ≤ w entail w ϕ (this property also holds for all first-order formulas in the case of first-order models, see below). We refer to the literature for the standard results about Kripke models for intuitionistic logic.
We are now ready to move to more recent results. All the results we are going to mention are obtained by model theoretic methods, i.e. a result of the form QL(T) = J is usually obtained by, first, showing that T proves all instances of J (this is usually easy), and second, for every logical principle A such that J A, one constructs a countermodel M of T, which also fails that principle. In other words, there is then a T-substitution σ such that M T but M σ (A). We say that an intermediate logic J is characterized by a class K of Kripke models if and only if J A if and only if M A for every M ∈ K. The class of finite trees consists of the finite partial orders (P, ≤) such that for any p ∈ P, the set {q ∈ P | q ≤ p} is linearly ordered. This result was proved by using so-called blended Kripke models, and we will see an adaptation of this technique in §4. For now, we just note that Passmann's blended models are inspired by the models that Lubarksy [16] used to show various independence results around CZF.
The next two results were proved by Iemhoff & Passmann [17]. Note that IKP + is obtained by adding weak versions of strong collection and subset collection to IKP (for details see their paper).  For these results, Iemhoff & Passmann use (what they call) Kripke models with classical domains. These models are obtained by equipping each node of a Kripke frame with a classical model of set theory in a coherent way. An earlier result by Iemhoff [18] entails that these models will always satisfy IKP. Passmann showed in his master's thesis [19] that this result is in a certain sense optimal: there are Kripke models with classical domains that do not satisfy the exponentiation axiom (which is a consequence of CZF). The aforementioned results could be proved for large classes of logics because the simple structure of the Kripke models with classical domains allows much control about their logical structure.
Finally, Iemhoff & Passmann also obtained the following negative result for first-order logic with equality. Note that QL = (T) is obtained just like QL(T) with the additional requirement that substitutions commute with '='.  The following results were obtained by combining realizability techniques with transfinite computability. The latter is a generalization of classical computability by allowing machines to run for an infinite amount of time and/or use an infinite amount of space. For a thorough introduction, we refer the reader to Carl's book [20].   Table 1. An overview of the most important intuitionistic and constructive set theories and whether they satisfy de Jongh's propositional and first-order theorems, and whether their admissible rules are exactly those of IPC, as discussed in the survey. The question marks ('?') indicate open problems. The results marked with a reference within this article are new.  In general, all results surveyed in this section introduce assumptions on the logic J under consideration. We may therefore ask the following question (table 1). Question 3.14. Is it possible to extend the results of this section to larger classes of logics? If not, find counterexamples for which these theorems fail if the assumptions on the logics J are weakened.

Logics and rules of set theories (a) Logic, rules and the extension property
In this section, we will prove a set-theoretic analogue of Visser's [4, lemma 4.1] Main Lemma. Given a Kripke frame K, we write K + for the frame extended with a new root. The construction of adding a new root to a Kripke model was first used by Smorynski [22] for models of HA to give an alternative proof of de Jongh's theorem for HA. In the arithmetical case, it suffices to equip the new root with the standard model of arithmetic. The case of the set theory requires a more elaborate construction, as we will now see. ; is extensible if it is ∅-extensible.
To avoid cumbersome notation, we will say that a sentence ϕ is (Γ -)extensible just in case {ϕ} is (Γ -)extensible. We will later need the following two brief observations. such a tree is uniquely determined by the set of leaves above it. A set theory T is called subclassical if there is a classical model of T.
The following theorem follows the same idea as Smorynski's proof of de Jongh's theorem for HA [22]. For this reason, this proof method is also sometimes referred to as Smorynski's trick.

Theorem 4.4. Let J be a propositional intermediate logic characterized by a class of finite splitting trees. If T is a subclassical recursively enumerable extensible set theory, then J is the propositional logic of T(J),
i.e. L(T(J)) = J.
Proof. Let 2 <ω be the set of binary sequences of finite length, and 2 n be the set of binary sequences of length n. If T is a recursively enumerable theory, let Γ T be its Gödel sentence. Let ϕ 0 := Γ T , and ϕ 1 := ¬Γ T . Clearly both T + ϕ 0 and T + ϕ 1 are consistent by Gödel's incompleteness theorem. By recursion on the length of s ∈ 2 <ω , we define ϕ s 0 := ϕ s ∧ Γ T+ϕ s and ϕ s 1 := ϕ s ∧ ¬Γ T+ϕ s .
By inductively applying Gödel's incompleteness theorem, it follows that T + ϕ s is consistent for every s ∈ 2 <ω ; so, for every s ∈ 2 <ω , let M s be a classical model such that M s T + ϕ s .
We now observe that, given s, t ∈ 2 <ω of the same length with s = t, it must be that ϕ s and ϕ t are jointly inconsistent: Let i be minimal such that s(i) = t(i). Then s i = t i, and we can assume, without loss of generality, that s(i) = 0 and t(i) = 1. The sentences ϕ s and ϕ t are defined as conjunctions in such a way that ϕ s contains the conjunct Γ T+ϕ s i , and ϕ t contains the conjunct ¬Γ T+ϕ t i . Since s i = t i, it follows that ϕ s → ¬ϕ t . We can conclude for n < ω and s ∈ 2 n that M s ϕ s ∧ t∈2 n \{s} ¬ϕ t .
Let T be a set theory and J be a logic, as given in the statement of the theorem. To prove that L(T(J)) = J, we will proceed as follows: Let C be a class of finite splitting trees that characterizes the logic J. It is clear that J ⊆ L(T(J)). To show that L(T(J)) ⊆ J, we proceed by contraposition. So assume that J A for some propositional formula A, then there is a finite splitting tree (K, ≤) ∈ C and a valuation V on K such that (K, ≤, V) J but (K, ≤, V) A. On the basis of this propositional Kripke model, we will construct a Kripke model M T of set theory and a propositional translation τ such that M A τ . As M is based on the frame (K, ≤) J, it follows that M T(J). Hence, it follows that A / ∈ L(T(J)). As every finite splitting tree can be constructed from its set of leaves by iterating the operation of adding a new root, we can obtain a model of T on the frame (K, ≤) as follows. Find n < ω such that there are at least as many s ∈ 2 n as there are leaves in K; let l → s l be an injective map assigning sequences to leaves. Assign the models M s l to the leaves of (K, ≤) and use the extensibility of T to construct a Kripke model M of T with underlying frame (K, ≤). Given v ∈ K, let E v be the set of leaves l ≥ v. Then consider the formula Note that IPC is characterized by the class of finite trees [23, theorem 6.12]. To show that IPC is characterized by the class of finite splitting tress, note that duplicating branches of a tree does not change the formulas satisfied at the root.

Corollary 4.5. Let T be a subclassical recursively enumerable set theory. If T is extensible, then the propositional logic of T is intuitionistic propositional logic IPC, i.e. L(T) = IPC.
Let us first observe the following helpful fact. Recall that a theory T has the disjunction property whenever T ϕ ∨ ψ implies T ϕ or T ψ. Lemma 4.6. If T is an extensible set theory, then T has the disjunction property.
Proof. By contraposition. Assume that T ϕ and T ψ, then there are models M 0 and M 1 of T such that M 0 ϕ and M 1 ψ. Let M be the disjoint union of these models, then M + T as T is extensible. Moreover, persistence implies that M + ϕ ∨ ψ; hence, T ϕ ∨ ψ.

Lemma 4.7. If T is an extensible set theory, then Visser's rules are admissible in T.
Proof. By lemma 4.6, it is sufficient to show that the following rules V n are admissible: The admissibility of these rules is a standard argument and proceeds as follows by contraposition. For greater readability, we write σ A for σ (A) in this proof. Let σ : Prop → L sent ∈ be any substitution and assume that T n+2 In this situation, we can assume without loss of generality that M j , r j n i=1 (σ A i → σ B i ), but M j , r j σ A j . Now, let M be the disjoint union M j | j = 1, . . . , n + 2 of the models. As T is extensible, consider a model M + extending M with a new root r such that M + T. By persistence, r σ A j for all j = 1, . . . , n + 2. Hence, We may conclude that the rule V n is admissible in T.
The following theorem is a direct consequence of corollary 4.5, lemma 4.7 and theorem 2.13.

(b) Extensible set theories
In this section, we assume the existence of a proper class of inaccessible cardinals (see remark 4.17). We will prove the extension property for a variety of constructive set theories by providing one particular construction for extending a given model. This construction is an adaptation of Passmann's [15] is defined as follows: (i) Let r / ∈ K, the so-called new root. Then extend K and ≤ as follows: (ii) The domains D v for v ∈ K are already given. The domain D r at the new root is defined inductively as follows: To help the reader digest this construction, we will give a simple example and provide some general intuition for the construction. Let M be any classical model for set theory. In other words, M is a one-point Kripke model; call its single point v. The extended model M + has then a new root r. An element of the root D r -a set at the root-is a function x with domain {r, v} such that x(r) ∈ D r and x(v) ∈ D v . Moreover, if y ∈ x(r), then y(v) ∈ x(v). Intuitively, a set x at node r may thus already contain some elements at the root r but may also collect new elements when transitioning to v. Another way to think of this construction idea is as adding a new root whose elements are approximations of the sets already existing in the model we are starting from. The next step is to observe that many set-theoretical axioms are extensible. For convenience, we abbreviate the axioms of extensionality, empty set, pairing and union with Ext, Emp, Pair and Un, respectively.
Proof. We will prove all statements of the theorem by assuming that a model M satisfies the relevant axiom or scheme and then show that the extended model M + satisfies them as well.
For extensionality, let x, y ∈ D r . For the non-trivial direction, assume that r ∀z(z ∈ x ↔ z ∈ y). By persistence and extensionality in M, To see that also x(r) = y(r), observe that z ∈ x(r) if and only if zE r x(r). By assumption, the latter is equivalent to zE r y(r), which holds if and only if z ∈ y(r). In conclusion, y(r) = x(r).
For the empty set axiom, let e v be the unique (by extensionality) witness for the empty set axiom at v ∈ K. Define a function e with domain K + such that e(v) = e v for e ∈ K and e(r) = ∅; by uniqueness, e is defined, and it follows that e ∈ D r . To see that e witnesses the empty set axiom, let x ∈ D r . We have to show that r ¬x ∈ e. For this, it suffices to show that for all v ≥ r, v x ∈ e, but this is trivially true as e(r) is empty and e v is the empty set for all v ∈ K.
For the pairing axiom, let x, y ∈ D r . By pairing and extensionality in M, there is a unique p v ∈ D v such that v ∀z(z ∈ p v ↔ z = x(v) ∨ z = y(v)) for all v ∈ K. Define p to be the function with domain K + such that p(r) = {x, y} and p(v) = p v for all v ∈ K. Clearly, p ∈ D r is defined by uniqueness of the p v . To see that p indeed witnesses the pairing axiom, observe that, clearly, r x ∈ p and r y ∈ p. Moreover, if r z ∈ p, then it follows by definition of p that r z = x ∨ z = y. For the union axiom, let x ∈ D r . As mentioned earlier, by extensionality and the union axiom in M, we can find a unique witness u v such that v u v = x(v) for every v ∈ K. Then define a function u with domain K + such that u(v) = u v for all v ∈ K and u(r) = {y(r) | y ∈ x(r)}. To verify that indeed u ∈ D r , note that y ∈ u(r) implies that there is some z ∈ x(r) such that y ∈ z(r). Now by y, z ∈ D r , we know that v y(v) ∈ z(v) ∧ z(v) ∈ x(v), so, clearly, v y(v) ∈ u(v). It is now a straightforward computation to see that u witnesses the union axiom at r.
Regarding ∈-induction, suppose for contradiction that r ∀x(∀y ∈ x ϕ(y) → ϕ(x)) → ∀xϕ(x). Then there is some v ≥ r such that v ∀x(∀y ∈ x ϕ(y) → ϕ(x)) but v ∀xϕ(x). As M satisfies ∈-induction, it must be that v = r, and so by persistence M + ∀x(∀y ∈ xϕ(y) → ϕ(x)). By ∈induction in M, M ∀xϕ(x), so all failures of this instance of ∈-induction must happen at the new root r. Thus, as r ∀xϕ(x), it follows that there is some x 0 ∈ D r such that r ϕ(x 0 ). Using the antecedent of ∈-induction, this means that there must be some x 1 ∈ D r such that r x 1 ∈ x 0 and r ϕ(x 1 ). Iterating this construction, we obtain a sequence {x n } n∈ω such that x n+1 ∈ x n (r). This straightforwardly gives rise to an infinitely decreasing ∈-chain. A contradiction.
Next, we consider the separation axiom. Let x ∈ D r and ϕ(y) be a formula, possibly with parameters. Now, for every v ∈ K, let s v be the unique result of separating from x(v) with ϕ and parametersp(v) at node v. With persistence and extensionality, it follows that the function s with domain K + such that s(v) = s v and s(r) = {y ∈ x(r) | r ϕ(y,p)} is a well-defined element of D r ; if α is the least such that x ∈ D α r , then it is easy to see that x ∈ D α+1 r . It follows straightforwardly from the definition of s that it witnesses separation from x with ϕ at r: r z ∈ s is equivalent to z ∈ s(r), and the latter holds by definition if and only if r ϕ(z,p). Note that the proof of 0 -separation schema is a special case of the proof for the separation schema.
For the power set axiom, consider x ∈ D r and let β < κ such that x ∈ D β r . If y ∈ D r such that r y ⊆ x, then y(r) ⊆ x(r), and hence, y ∈ D β r as well. Let p(r) consist of those y ∈ D r such that r ∀z(z ∈ y → z ∈ x), then p(r) ⊆ D β r . Moreover, let p(v) be the unique element of D v such that v p(v) = P(x(v)) (using extensionality). By persistence, p is a well-defined element of D r . It is then straightforward to check that p is the power set of x at r.
For replacement, let x ∈ D r and ϕ be a formula (potentially with parameters) such that r ∀y ∈ x∃!zϕ(y, z). Given this, let a(r) consist of those z ∈ D r for which there exists some y ∈ D r with r ϕ(y, z). Moreover, let a(v) be the witness for applying replacement with ϕ on x(v) at v. By inaccessibility of κ and persistence in M + , it follows that a ∈ D r . As in the previous cases, it is now straightforward to check that a witnesses replacement.
For exponentiation, let a, b ∈ D r . Let z(r) be the set of functions from a to b at r, and let z(v) be the set of functions from a(v) to b(v) at the node v. It follows that z ∈ D r , and it is easy to check that z witnesses the exponentiation axiom.
Recall that the axiom of strong infinity asserts the existence of a least inductive set. So, for every v ∈ K, let ω v ∈ D v be this least inductive set. At the new root r, we recursively construct sets n r as follows: Let 0 r be the empty set as defined from the empty set axiom. Then, given n r , use pairing and union, to obtain (n + 1) r such that r (n + 1) r = n r ∪ {n r }. As each ω v is the least inductive set at v, it must be the case that v n r (v) ∈ ω v for all v ∈ K. Therefore, the set x, defined by x(r) = {n r | n ∈ ω} and x(v) = ω v for v ∈ K, is a well-defined set at r, i.e. x ∈ D r . By construction, we must have that if r 'yis inductive , then r x ⊆ y. Hence, x witnesses strong infinity.
A combination of theorem 4.12 and lemmas 4.2 and 4.3 yields the next corollary. An application of theorem 4.8 then yields corollary 4.14.   Remark 4.17. It is not strictly necessary to assume the existence of a proper class of inaccessible cardinals as (at least) the following two alternatives are available: Firstly, we could work with Kripke models that have (definable) class domains. Secondly, we could apply the downwards Löwenheim-Skolem theorem (which does hold in our classical metatheory) to work, without loss of generality, only with models with countable domains. In our view, the solution with inaccessible cardinals is the most elegant as it allows us to ignore any worries about size restrictions.

Questions
We close with a few suggestions for future research. In this article, we gave a first structural analysis of the logical structure by observing the consequences of the extension property. Are there other structural properties of set theories that determine (parts of) the logical structure of a given set theory? Question 5.5. Let T be a theory. Given a class Γ of set-theoretic formulas, we can obtain the notions of Γ -propositional logic L(T) and Γ -first-order logic QL(T), as well as Γ -admissible rules by restricting to those T-substitutions that arise from T-assignments with domain in Γ . Natural classes to consider are, of course, the classes of the Lévy hierarchy but other cases are thinkable (such as prenex formulas). What are the logics that arise in this way?
Note, regarding the previous question, that the substitutions used to prove the results in §3 are usually of rather low complexity, e.g. Σ 3 or Σ 4 . Therefore, the question is often only interesting for classes of lower complexity. For instance, Visser [4, sections 3.7-3.9] considers Σ 1 -substitutions.
In this article, we have only considered set theories on the basis of intuitionistic logic. Of course, one can also analyse the logical structure of set theories based on other logics. Löwe et al. [24] take some first steps towards an analysis of the logical structure of certain paraconsistent set theories. Another related problem is to determine the provability logics of constructive and intuitionistic set theories.

The classical case
In this final section, we briefly discuss the logical structure of classical theories. Recall that a logic is post-complete if it has no consistent extension. Theorem 6.1. Let T be a classical theory. If T is consistent, then T satisfies the de Jongh property for CPC.
Proof. Since T is classical, it must be that CPC ⊆ L(T). As T is consistent, ⊥ / ∈ L(T). Hence, L(T) = CPC as CPC is post-complete.
The case for first-order logics of a given theory is more complicated as they are not postcomplete; Yavorsky [25] proved that expressively strong arithmetical theories T, such as PA, satisfy Proof. Theorem 6.1 implies that L(T) = CPC. As is well known, ∼ CPC = CPC (a proof can be found in [26]). Thus, the second part of the theorem follows from the first.
For the first part, the direction from left to right has been proven in theorem 2.11. We treat the other direction. Arguing by contraposition, assume for some propositional formulas A and B that T ρ(A) and T ρ(B) for some substitution ρ from the language of propositional logic to the language of T. We have to show that A ∼ L(T) B. Assumption ρ(B) implies that there exists a propositional model M of T and a valuation v such that M, v | ρ(B). Define a substitution σ in propositional logic as follows: It is easy to see that for any propositional formula C, the formula σ C contains no propositional variables, which implies that σ C is equivalent to or to ⊥. Therefore, L(T) σ (C) or L(T) ¬σ (C). (6.1) By using (6.1), it is easy to prove by induction on the propositional formula C that In the remainder of this section, we show that the first part of theorem 6.2 can be lifted to the predicate case, at least for theories for which QL(T) = CQC, and the second part cannot. The predicate version of the first part of the previous theorem states that ∼ T = ∼ CQC and the second part states that ∼ CQC = CQC . To show that the first statement is true for theories T such that QL(T) = CQC, we first have to prove that the second statement, while not true, is almost true; we have to show that CQC is almost structurally complete.
As remarked earlier, CPC is structurally complete, which means that any admissible rule is derivable: for all propositional formulas A and B A ∼ CPC B ⇒ A CPC B. (6.3) In other words, ∼ CPC = CPC (see also Iemhoff [26]). It is easy to see that, unlike CPC, CQC is not structurally complete. Consider the formula ∃xP(x) ∧ ∃x¬P(x) and observe that for no substitution σ , the formula σ (∃xP(x) ∧ ∃x¬P(x)) is derivable in CQC. For if it were, it would hold in models consisting of one element, quod non. This implies that ∃xP(x) ∧ ∃x¬P(x) ∼ CQC ⊥. And since ∃xP(x) ∧ ∃x¬P(x) CQC ⊥, this shows that CQC is not structurally complete, i.e. that ∼ CQC = CQC . However, the admissible rule ∃xP(x) ∧ ∃x¬P(x) ∼ CQC ⊥ has a particular property, it is passive. We will show that the only non-derivable admissible rules in CQC are passive. In the terminology of admissibility: CQC is almost structural complete. This result was first obtained by Pogorzelski and Prucnal [27]. Here, we prove a modest generalization that applies to a class of consequence relations instead of a single one. Recall that a rule A/B is derivable in CQC if A B, where is a consequence relation of CQC, by which we mean a consequence relation that has the same theorems as CQC: A iff A holds in CQC. Thus, strictly speaking, the notion of derivable rule depends on the given consequence relation of CQC, which is why we make it explicit in the discussion below. Since the derivability of a formula does not depend on the consequence relation (because all have the same derivable formulas), we can leave it implicit in such a setting, as in the next lemma, where CQC denotes any consequence relation for CQC.

Lemma 6.4. A formula A is unifiable if and only if there exists a ground substitution τ such that
CQC τ (A) and τ (P(s)) = τ (P(t)) for all predicates P and sequences of termss,t.
Proof. It suffices to show the direction from left to right. Since A(x) is unifiable, there exists a substitution σ such that CQC σ (A), from which it follows that CQC ρσ (A) for any ground substitution ρ, as CQC is closed under uniform substitution. Clearly, ρσ is a ground substitution too. That ρσ satisfies the second part of the lemma follows immediately from the definition of substitutions. Proof. Since A is unifiable, there exists, by lemma 6.4, a ground substitution τ such that τ (A) and τ (P(s)) = τ (P(t)) for all predicates P and sequences of termss,t. Firstly, note that this implies that τ (B(s)) = τ (B(t)) for any formula B. Letx be the free variables in A and define a substitution σ as follows:  Case B = ¬C. If τ (¬C) ↔ , then since τ commutes with the connectives, we must have that τ C ↔ ⊥, which by induction hypothesis implies that σ C ∀xA ∧ C. Thus, σ (¬C) ¬(∀xA ∧ C) ∀xA → ¬C.